US OCC Issues First Bank AI Framework, Classifying Autonomous Payment Agents as Highest Risk
The US Office of the Comptroller of the Currency released its first AI supervisory framework for banks, placing autonomous payment agents in the highest risk tier and emphasizing human oversight mechanisms like circuit breakers.
The U.S. Office of the Comptroller of the Currency (OCC) issued its first supervisory framework for artificial intelligence in banking on November 4, 2026. The guidance directs examiners to focus less on an AI system's technical sophistication and more on the consequences of its errors and the degree of autonomy it possesses.
A key feature of the framework is a four-tier illustrative risk classification. Fully autonomous payment agents, real-time credit decision systems, and fraud transaction unfreezing fall into the highest category (Tier 1). Lower tiers include AI-assisted underwriting and basic internal productivity tools. The OCC notes that a simple agent authorized to initiate transactions may present greater risk than a more advanced model limited to writing internal documents.
The framework emphasizes that human oversight cannot be merely formal. It distinguishes between 'Human-in-the-Loop' (approval before execution) and 'Human-on-the-Loop' (continuous monitoring with intervention rights). To address the risk of AI agents continuing to execute harmful tasks without crashing, the OCC suggests safeguards such as rate limits, least privilege access, circuit breakers, and emergency kill switches.
The guidance also addresses external AI agents operated by customers or fintechs that connect through bank channels. It recommends measures including identity verification, delegated permissions, transaction limits, and dispute handling. The OCC stressed that this document does not create new regulatory requirements but helps integrate AI into existing operational, compliance, and cybersecurity risk categories.